zeekay 788166713a security: fix IDOR, SSRF, HMAC replay, JWT iss/aud, SOR injection ...

CRITICAL:
- Account ownership middleware on all /accounts/{provider}/{accountId}/* routes
- Deposit/withdraw: verify account belongs to authenticated user

HIGH:
- Webhook SSRF: HTTPS required, reject private IPs, loopback, link-local, internal hosts
- HMAC replay: reject signatures with |now - timestamp| > 5 minutes
- JWT: validate iss matches IAM endpoint, aud contains expected audience
- SOR: build accounts map server-side from resolver, ignore client input

All 43 packages pass. Zero failures.

2026-04-07 19:52:17 -07:00

..

memory_store.go

feat: taskqueue client + 20 webhook tests + prefix filtering + org isolation

2026-04-07 15:50:36 -07:00

routes.go

security: fix IDOR, SSRF, HMAC replay, JWT iss/aud, SOR injection

2026-04-07 19:52:17 -07:00

store.go

feat: webhook infrastructure — 16 BD events, HMAC delivery, routes, store

2026-04-07 15:10:25 -07:00

webhook_test.go

security: fix IDOR, SSRF, HMAC replay, JWT iss/aud, SOR injection

2026-04-07 19:52:17 -07:00

webhook.go

security: fix IDOR, SSRF, HMAC replay, JWT iss/aud, SOR injection

2026-04-07 19:52:17 -07:00